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IN THE UNiiira]DasnMnffisn)$3T?MCEx:ocmET 
FOR THE DISTRICT OF ALASKA 

UNimDSSnMnffiSQK^AMlEEt^^ ) 

) 

PMitlffy, ) 

) 

V. ) 

_ ) 

PETOE YURYEVICH IffimMW,, ) 

a/kla "Petii' Levasflio^;” "Peto” Sevaia^i"’ ) 

“Petii’ Sevens',”’ and 

) 

Defendsitt. ) 


coMPLAiwrr 

PBahttfiCf, the Unilteii Statfess of Ameaiik^,!:^ and tBmcEii^ its uacateBspedd 
couns^.alld^es the following: 

L. This is a civil aattixm broun^itt unden’ Titite 118^, Unitadi StaCfe Code, 
ScctissofiilBSl^ and 2521, and FedenMl Rule of Civil R)csim!liiree665, to eiqjoffli the 
Defend^! from conSunuigg to eng^^ in wire fraoiid and unmtl^iiedd ind^rcf^on of 
©l©E#imi«»OTraiBraida^ in violaitinm of Tillte 18, Unuitefl Stat^ Code, ^Ktftoni 

1343 and 2511, hy meansB of maDiiiain)oiKa33niipal4EB(^ftiMai(d']iiahskt^'^diii(knflwn ai 
Kehlhsffi. 

2. KehDDBEffiiB maHwaave that emUiHtBs iiifeiatedioaraijpjfldEa'kAnto — a 

ncttvwjjik of othen’ compiOBiiHBadlccmQgptdm’sarc^ by the Defendsant.lJdiiwdyalal 
imifeisdtetiaHmjinli4E9,’s, or “bots,” an® contncdltetirECJintdl^y thntsn^h a demittatifedd 
eemmatwH and eontaall CCSiEJ) sysiam in whidbiirifetfeddcoaanppto or "peeis^,'” 
remain in contaolt witii eadn othea*. 


U.S. V. ]Lffi«®iiiiov 
3: ]l'7-<»v41Si ) 
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3. Onee iiirifedM3b^5i5iffihE>3p(fflnppiioiH3ded3TO^ wiiWin tlhe botoffitt 
ai^ by Ife Defenn^iit to genaisAie hn^WidLinises of uiB£Biiltdib^''‘^aib’’ em&ik 
that a<dk®atii6ffoanttlrfefeifrdg^gsMppmpdadub4’^®t*pl®**®^’®^^™e^''»*3i^®fe'home 
scau%, and othai' fmidis. M^tilihos is alMs to gensn^te plbsyiii^ euml^, bas\v^t 
usifir cretHeottaMs, and to dowimlkBQjtla^ditinadal maill'i)ix^:£e onto^t^hnocmipit^^’s, 
indnixflii® ransamvaaare and baodtih^ Tiragjattss. 

Pantima 

4. Plamttfff is tBue Unilfadi Staiife of Ameflitea. 

5. Defendant Peter Yiiryewnadiillfla^hhov is citiastn of Rii®aia wb® 

in St. Peteffiibwiig. Defendamtt u^sb tflne aKa^ss Petr Leva^hwy.lPeteff Pftf 

SeveiKa, and Sei^^v^ftaabibhoy. 

JoiridiititiDn and Venaffi 

6-. matffl®!-jnniiBiiett»orliliss punsofflitt to Title 18, UiSfflflgtii 

C©d@, S^fi»&lC8l4$4^(l) and 2521 and Tiiflfe2^, Unifeti SfeK^ Code, S©(Ai©n§ i33t 
and 1345. 

1 -. Defei«tott is snfejMt t® the penaamdl jnnrikiiibittffliirofif tMs Court;, 
ialfei?J»tiQQjnQMl4ra,-s, u^d infedtediafflaiipMdEa’s in funStetaaoee of hfe te 

deftauti, and enga^dl in unaitbboizisdd wiistte^pngg, all wltiban tlb^ @f 

Ala^]^. The Defend^t has alssB sent nnnnanmms frmtdUtoOit aisdl fflMidiaU 3 eiltert 3 >©feic 
me^agesttqjpEstMBis witBnikn tBn® Distoiiflt of Aladi®. 

S-. VittUfe is pi®s!sn- in tflnis Distaidt pursirant to 28 U.8,C.. § 13@B(fel^^). 

rr 

U.S:. V. Leva^hnv 
3:ll^v-00_ 
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The DefemrifaMblfe’s Schanse to Defrauij angl Rm ^i pqpfe in IMegadl Intearefflation 


9. The Defemdmtt is one of the woiMfe most nofemimss ciinmiirail spammers 
who was iiuhktteld in the Ea^fenm Distiatt of Michn^n for emaiill and wii^ fraodl 
mote thajm a dejadieaggo. The chants aisES® out of the DefernflamC’s use of ille^l 
spam to pnsmjlte pumgiHavMddmpp pena^ shack schemms. 

10. In 200^., the Defendmtt was agaim the sudpsnt of criMuGil charges, thas 
tomm in the Distuittt of Coliunildm. The Oin-«^. rimiim al complaint chai^^ the 
Defendant with compnito- fraiuii vioMimss airiising ftom his opeiartion of the “Stoami'” 
botnf^t, a pQt^tteeeseor to Kehlhis that was also used to distbxtino^e ille^l sp^tm. 

1L The Defemtenit has long heem a fixtarre on the list of the WorM’s Ten 
Worst SpannmBarrs, whikch is mainttonadd by tBue aniii-spam orgaiiiaaidon Spamlteuss. 
CuanBanl^jV, the Defendantt occupiesB the sixtfla spot on the lisit. 

The DefeimfarrtWs Use of Kelihos 

12. Sinae about 201®!, thelBefendaealt has been the opeisatoi’ of the KeliflosK 
boltt^t, a netiwaoBc of compintters infedted with maDware disttarthnidd by the Defendsant. 

13. K@]iihQ% is a sophi^i<i;eitddd mahnmre vaiiiantt that is used by the 
Defendantt to han^i^tt user credeottiMs fioiniii\diaiiinncooipptoters, pns^pe^ate hta^ 
quanlitMes of spam eniaills,aand to disthrlhiiote othai’ fonaniss of malwane. 

14. The KelliilinsB maDm'aaie haowasatts user creifentiallsfibimiwidiim compmfeffKs 
thnsoi^ a r mnntiiHimT of m^ftbolis. First, KelBnoas seanoHess text-based files stsssd on 
vietoitt computtffss for email acMassees. Se©oiBxfl,H6d:i]iihss seaoalhBss locations on victim 
compoiltiarrs for filler knowna to contaiin usmimi»es and paa^wonlds, indtouiii^fjriles 

U.&. w..ILes^aabh0v 
3: ll-eV'O®_ 
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witii Tnttgnm tft. brow^i^G!^(D(nn^FffefelQx, and Tntfegnm fftt. Explbn^r. 
emaiil aiihBsses and pascsiwsiiis locate in tBus^ seamiless ais haav^os^^dd by KeliBosiss 
and sulsaGopesiitili^y bratiBmitt^d back Its thm Defem^entt. 

15. To captmre additam^l user credcntt^sKl^UkBss imtMUs a snfbRmt^ 
pMgnmin caBtediWhlRD^ffl^Mririfi^^fetdiaclidiianes. WinPCM* is a powaifiill padkatt 
captUK® utiili% that interefjSts, in reafl tiniiffi^.^isxttoomcoaimiimm^ tnssi^aJBsahgg 
tSne victihna»ni|pit^e'E’s netmisii& caid. Usemmnces and pa£^iwinii^(Giaiadd witiUin 
nettvKonik tiatffix ars tiaissiuittdd backtts tke Defendant. 

16. The credsBttMl haaweitiigg opeiariixm desoiftHiiaiteo^ is us©d by tte 

D@f@eidantt to fuitfifffi’ hisiillll^^l spamnrihg opei^dxim. The Defendant pi»n»gitlasliiiis 
spanamin^ oper^anibi^>p^Gm^g adv^ittiseiuBtsts in vamiausanilBiBe ciimindl forM^ in 
whi^ tide Defenitortt pBanmattBs his ablii^ttodddhfeer spanm email. In hi* aaii^, tte 
DefeittiS^t stait^ that he laumdkes spam from tkcsion^idl clesfli IF 

and iee0Uttfe)*’^ttghhMi'apie that incateassss the characss that tfc Defendan'fe’s sp^ 
ima^lte^wllleendde the filteoss put in plasce % emaiil provitossseekkiggoto pit®te£tt 
custtoanmEs. 

17. The "cleaia!” IP addoassses and accounlte that power the Defendant’s 
spammihgg opei^ianaaee, in fact, the coopted IP addnaassesaaddifor email accoujafecdf 
Kehftaswcttinss.TBh^e IP addnassses and email accountte ai® leveai^gssddb^ 

Defendant in two ways. In some easaffis, the Defendant instoietts th® hot* in hi* 
KehBififi botn^ to send spam diieetily, in essem® tasomh^ victhmsiiinngmtei's intts) mail 
soi^(©Bs that disimihidite spam to the redipikirtt emaiil addnQ$sffieq3paTOkiddd)^y the 

U.S. V. Levasfluw 
3: ]17-®w ^ 

5 

Case 3:17-cv-00074-TMB *SEALED* Document 1 Filed 04/04/17 Page 5 of 10 









Defeiudaaitt. In otfa^' Defeiu&rttt levei^gpss tln^ credentiaMs haax^ee^fedd by 

KeliffluCTs to gaim unianlbbonie^dd access to commooMl emaijl senwns^.wbbdbh ai® them 
used to tiaaKniit the spam In thes£ihs^B(rB%s, the spam me^s^gppss senlt 

by the Defem&ntt appem- to ongiint^eeddiai^yllr^gnin the victiianii^ email aeeounitt. 

18. The spam cam^m^s iniltofedd by the Defendamt vaiy in contentt basaafl 
on cusHaanfflitMeraadd, and the Defend^! diffeienttatos his prioog based on the 
natunm of the spam messa^yppss. IMihifc&imiadardEtk^iHenli^nts, the Defends! offers li(5) 
dehvea’oaisennmlilibon spam mesaBaBgpBSfpDDintitigiglS^&lprpdradtKts such as "adailtf, 
moifl^gpejdaddsp^iila^pipkcs [a.e„couiiiteif&iggoddyeftt<!i.’fdb$OT£!0. The 
D@f§nd»it'1^s priKeimoreages to $300 per miiiiismmBBsaggetf&fj'^bbjspadi^BSgsfages 
se^ahgtto recraiit job seeheoss intt® fraoidldfetiiiit posMirassAhabldiiiggrriDiteida” - pesasa® 
roamitcdd to lauantoi- money and goods stdkm by crittsihsdis. The Defeffldsant aJ®® 
piolfesssss his wiUiiagiBsss to pio 5 !ia^^te"§ 6 aaiij/hhiahgTg;tafclsdka<hi'®ftiich the 
Defendantt piomifi®s to deliv®rifin’^ffi®0 per milIlliiHsmrnB8sagge.s. 

19. In convei^tdxmagjpssss^sfetijby the FBI,, the Defendant pjieirafeili 
adhttiowil insii^t into Inspiaihgg stnuoltmee. Im tftimemoanTCeajaaliiBns, the Defeisdsant 
offers to send mes^gtss that would infeat usens with a lyps of mahrare knewni as 
raosannwatt®— malliidiHiBsssrffbwiaa’e that enoypte the contents of victim casaipjl^ea’s 
and them d@m»nlts a rauBsmn to retmnm the enenygltdd files ttoa reacMbie state. The 
Defem(itert' 1 ^ 5 )lics:e: $500 per miIlliiimn®nBaiEs.IiIn the same convef^taon- the 
Defendant offers to send emaiilfe piomiiiaiihggaappmpiaiabdu^ peimy^ sted^adtem^, 
desigirKti to drix® up the ptiiaE of a thtiri^yttadddd secunii^. For mess^gge§, the 

U.S. V. Levasflnw 
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Defendmtt demaidteti a (ooimiimsdxDin basM on th@ movem^t in tins stB!i£^^];priaee that 
occunfidi as a resoiitt of tSn^ spam carngoGaipa. 

20. In adJiltiinn h) uaiii^ Kelilos to distmihilte span^, tihis Defeim&nlit a]^ 
preAteHjy umig KelilHKttodiiiied^y instladll malbwpaarEe on victiimcKDnQWlhiffii’s. Dmrin^g 
FBI tes^i^I^^bhhss was obsenv^eati inslMUDigg raummwaaore onfa»£ test maeMieo, as 
well as "VawteBiR” bainftiii]g Ti«gam (usecfl to steail login credtenttaMs used at finatnoail 
inslittiiitimis), and a mdiraaMa^Wodd documartt desi®iBddt(bQiifEfelct tin© compinteai- witii 
the KroonK banMi^ Trojan. 

21. The Defendant and thiS]^ actiii]g at his dirndUnm ha^ inffeglbdd 
humhcaiis of thonisandds of computteBs amimid the woiM with Keliflu^, indhudi^ 
compmtteFs withiin the District of Aladfea. 

22. Pensoaiss in thdis Distmint ha«® also been the tan^tt of fraadhitemt and 
malicious spam emalis that the Defendant has sent via the KeMBraffi botostt. Tbe^ 
tan^Ss inicludeeaiiipjd^yeeshf Alad^’s pidldlicssdlassd)! disitiitts, thoonsmiidds of cusobmts'ss 
of Alashan internet serwtiiegmyMder Geneiadl Comramriioaitinn Ine. (((SO^l.empjtdyyees 
of the citii^acdAadhxDsgge and Hiiniiean, and em^ihpBsss of the Alaska Division of 
Occupatiioiindl Licenah^. 

COIMITII 

(InjiaiiBttYvd^lief undei- 18 U.S.C1. § 134S)) 

23. The Unilteril Stateess of AmeniiiaiaiilHgfes and ineoiparateh^yefefeneece the 
presedhgg paiK^gn|]|tihs of thiis Complaint as if fu[% set fortih hetram. 

24. The Defendant is en^^psdi in wiieflBaaidd, in violation of Title 18, Uniilteafl 
States Code, ;^niam 1343, in that the Defenxftaoht, havdnig devSseatiaasehhinme or 

U.S. v..ILffl^^a3hhov 
3:ll’Cv-0(D)_ 
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aitliifiH3B to deficauli and for obtaahii]iiggTinDBgpi)^y mean® of false or framdiiiteilit 
pietteiseeg, is tnaaissmititigg and cauHaiigg to be totissniliMdd, by means of wire 
commmiiiiiaaiidmn in intensatote and foreigmfflammBJTX^.widtii^sygig and sigunriteffim’ 
tine pm^nsse of execulditig suciii schsnme or aitliffbee. 

25. PttTsuantt to TillfellS, Uniteii Statbss Code, Sectlion 1345(a]) and (b), tine 
Umltefl Stadass of Ameiikm leupseats tteisssiaaoce of a temporaiy resllnaaimgg ordej;, 
pidiiniiiaayy injmnutiixen, and petmmtenlit irpmuttixisn agaiiii®t dloe Defendant and his 
ag^mdaB in orden'tto pieiientt a comtmunigg and substteitiMbl iipnc^ to the ownei® and 
le gitrihrat^ e usai® of the inffisdtsdlaQimputoB® in tibe Kelihe^lktttii^.t- 

COUNT II 

(Injninnltw^fRtiMf f nndeir 18 U.S-C. § 2521) 

26. The UniiBKti Stattes of America ailt^gss and incoipsoafees by refeastoee 
the pieeetfihg pan^gxqc^s of tlmss Complantt as if fulfy set fortJh his^in. 

27. The Defendtortt is eng^ignti in the unaithbeiaedd intteog^laen of 

in violafliinnodnEtMelS8, Uintedi Stated Code, ^etiion 
2511, in thatt the Defendant is iHttonildonb^y imtere^Mgg electorniicojflflSMttidMfeitsjs, 
and is inBsittJWQnipyiiiB^g and ende®AOQrii]^dsais©e the contents of electeffliic 
e 0 mmiairic^tikmi;k(nwwigig that the iiifoinin^tiiajrias obtained themt^h tb® 
unmithbimedd inltono^Man of electnmicoetnnniMhiaibit^ 

28. Pursuant to TMte 18, Uniiitefl Statesi Code, Sediian225321, the Uflhted 
Static of Ametika rei^i^ts the issmmnmrffaa temigHnaiyy resttBahhigg ordeff, 
pr^Oinimayy injtomttitxBi;!, and peimmimiiit iipimdimn agahi®t Defendant and bi^ 


U.S. V. Levaadnw 
S:ll'7-<av4B D 
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agenda in ordcn’ to pirwoitt a contdhuiibgg and sulistlaaitiakl injui^ to tte ownos and 
legidtthxaSl4e iisg°n5K of tUna^ inifegfetriinarnripilit^ in tfluE KeliBcffias botiin^. 

PRAYER FOE RELIEF 

WHEIMRQlitE, tfa^ United Stattes of America pra^ thatt the Court: 

A. Enitea* jitt^anartt in favor of the GovernimBMlt aiMl agaiiiitet tie 
Defeiu&rtt; 

B. Puisairaitt to Tidtel]®, United Stattes Code, Sfflddons 134S((fe)) and 2521, 
enitei- a pi^Iininflayy injmnBttdxni and pernmaiBaitit mjjoiiiKttdxim agammat the Defendant 
and his agentte, senwiU^pHtp^s^ps^s, and all psossmss and enltitttes in actik^ouaiBffltt 
or paiStsijp&tinn with thean fipom ®i]^^iigg in any of the actisit^oaara^iaiiBdd of heasitn 
or from <eausaii® any of the injin^ compkahesd of heiidin and fiom a^stiiggaialid^g or 
abetting any othea- pet^an or bnshssss enlti% fiom eng^^g in or penffismmi^ an^ of 
tliife aetwil^yQQmt^iaifidobfef hei®iin or from carsigg any of the iniDary compMiKii of 
h@tem; 

C. Pmsatertt to Tilflte 18, United Stattes Code, SectiiaHiKlB3l4^l6l^) and 2521, 
entei* a pieliininaayy iigprajltdxifn and peimaiEartt ingjimtetdwraatMdi®^ the 
GovirwnmAt to eontamee the maDware disaragltdxnn plan spedifeoli in the Govemocsffln'fe’s 
Momonaidhiiin of Law in Suj^saitt of MotkmfcTItaajpaja^ Restaainagg Ordea’ and 
Ordett- to C^se Re Pnsdihriiiaag^' Ingjuunrttdwaj/cfoia^fiaDibd of six miHHittbp, and 
roqiuiiiii^ the ©nttiiess spedfied in the Tem^HHQaaryy Restndiniiigg Ordar to contmareetbo 
tatefe the aeldifiaisjsfpjdlisdd in the Teunpaarnyy ResIliiaaiiMgg Order for a gaHTwJirffssix 
mondh$; 


U-S- V. Levasdoaw 
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D. 


Order saidh othai’ relteff that tBne Court deems just and pr@|p©iL’. 


Dated: April 4^, 20IT 


BRYAN SCHRODEK 
Acting Uniiteil States Atteonr^ 




as A. BLANCO 


Acting Assistant Attomri^yCSiffiiBeafel 


By: tSif RichantflIRmMcoov 
RICHAKD MaMffiHKSBr 
YVONNE ILAMOOffiffillM 
ADAM ALEXANDER 
Assistoilt U.S. ABkHTK^s 
Distaiiilt of Alaska 


By: Is/ Rfllnam Armstcn _ 

ETHAN AREMSIN 
HAROLD CHUM 
FRANKJLIN 
Tridl Atteara^ss 
Computei<I3TiinBe and 
Inteltettukl Pnspstiyy Sectinm 
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